CVE-2020-9044

mediumPriorität · verfolgen · 36EPSS 0.013 · 70. PerzentilEUUS
grimoire priorityP3 · Track
Exploitable?
—
no known exploitation
Likely / severe?
1.29% (70th) EPSS
CVSS 6.4 · medium
Is it mine?
64 products
Prüfe deine Angriffsfläche
Who says so?
3 sources
cnnvd · enisa_euvd · cisa_csaf_ot

EPSS · bewertet 2026-10-27

XXE vulnerability exists in the Metasys family of product Web Services which has the potential to facilitate DoS attacks or harvesting of ASCII server files. This affects Johnson Controls' Metasys Application and Data Server (ADS, ADS-Lite) versions 10.1 and prior; Metasys Extended Application and Data Server (ADX) versions 10.1 and prior; Metasys Open Data Server (ODS) versions 10.1 and prior; Metasys Open Application Server (OAS) version 10.1; Metasys Network Automation Engine (NAE55 only) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys Network Integration Engine (NIE55/NIE59) versions 9.0.1, 9.0.2, 9.0.3, 9.0.5, 9.0.6; Metasys NAE85 and NIE85 versions 10.1 and prior; Metasys LonWorks Control Server (LCS) versions 10.1 and prior; Metasys System Configuration Tool (SCT) versions 13.2 and prior; Metasys Smoke Control Network Automation Engine (NAE55, UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed) version 8.1.

01

Behebungen

Hersteller-Fix, Mitigation oder Workaround, wie von den Quellen veröffentlicht.

Noch kein Hersteller-Fix; eine Mitigation ist verfügbar.

  • MitigationApplication and Data Server (ADS ADS-Lite)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationExtended Application and Data Server (ADX)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationLonWorks Control Server (LCS)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationNAE85 and NIE85cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationNetwork Automation Engine (NAE55 only)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationNetwork Integration Engine (NIE55/NIE59)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationOpen Application Server (OAS)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationOpen Data Server (ODS)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationSmoke Control Network Automation Engine (NAE55 UL 864 UUKL/ORD-C100-13 UUKLC 10th Edition Listed)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

  • MitigationSystem Configuration Tool (SCT)cisa_csaf_ot

    For questions concerning this product, contact Johnson Controls Global Product Security; email: productsecurity@jci.com icsa-20-070-05.json,vendor_fix,Do not click web links or open unsolicited attachments in email messages.,empty icsa-20-070-05.json,vendor_fix,Refer to Recognizing and Avoiding Email Scams for more information on avoiding email scams.,https://www.us-cert.gov/sites/default/files/publications/emailscams_0905.pdf icsa-20-070-05.json,vendor_fix,Refer to Avoiding Social Engineering and Phishing Attacks for more information on social engineering attacks.,https://www.us-cert.gov/ncas/tips/ST04-014 icsa-23-031-01.json,vendor_fix,Delta Electronics released version 1.3.0 of DIAScreen (login required) and recommends users to use DIAScreen instead of DOPSoft.,https://deltaiastudio.b2clogin.com/deltaiastudio.onmicrosoft.com/oauth2/v2.0/authorize?p=b2c_1_diastudiosigninup&client_id=9092aab8-5ccc-4a8a-a76a-59b00b7d0d52&redirect_uri=https%3a%2f%2fdiastudio.deltaww.com%2f&response_mode=form_post&response_type=id_token&scope=openid&state=OpenIdConnect.AuthenticationProperties%3dtSXw0hKpEQ9vkkvdbqbshwzywJBnOgHxqapYQrEFN1e07YOvSVHV4JuCnsD_u70KLfNuS1hKhM-fxE-PWfcOiK5DvJawVerhuz5N06I2xkJWLrZ0yh9PwixawgeMnt-gu8pNLCmqRH8jRkrirPp2XMz3lu8Qd1AmJGdk9xRhIziSEbdEjF0X8r2D4klk7yno&nonce=638084927799189443.NTVmNmFmNDMtYjNmMC00ZWY0LWI3ZjQtYzA0NTI0NTE5MTVmODE0MGU5ZGItNDhhMy00MDI5LTk4NWQtYzUxNjJkOGJiYmI1&ui_locales=en-US&x-client-SKU=ID_NET&x-client-ver=1.0.40306.1554#catalog icsa-21-266-01.json,vendor_fix,Affected users should contact a Trane office to make arrangements to install updated firmware or to request additional information. Please reference Trane service database number HUB-205962 when contacting Trane. Trane recommends the applications below be updated to the versions listed below.,http://www.trane.com/commercial/north-america/us/en.html icsa-21-266-01.json,vendor_fix,Symbio 700: Odyssey Split Systems: All versions prior to v1.00.0023,empty icsa-21-266-01.json,vendor_fix,Symbio 800: IntelliPak Rooftop Air Conditioner: All versions prior to v1.30.0008,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Ascend Air-cooled Chiller Model ACR: All versions prior to v1.10.0010,empty icsa-21-266-01.json,vendor_fix,Symbio 800: Agility Water-Cooled Chiller Model HDWA: All versions prior to v1.00.0010,empty icsa-21-266-01.json,vendor_fix,Restrict physical controller access to trained and trusted personnel.,empty icsa-21-266-01.json,vendor_fix,Use secure remote access solutions such as Trane Connect Remote Access

02

cvss

Technischer Schweregrad, 0–10. Eine Zeile je Quelle.

9.1
010

Basiswert 0–10 · höher = schwerwiegender · Vektor überfahren zum Auflösen⚠ Quellen uneinig · medium–critical · 6.4–9.1

v2.06.4mediumAV:N/AC:L/Au:N/C:P/I:N/A:Pprimary · NVD / NIST USAusnutzbarkeit 10 · Auswirkung 4.9
v3.19.1criticalCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:Hprimary · NVD / NIST USAusnutzbarkeit 3.9 · Auswirkung 5.2
v3.07.5highCVSS:3.0/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · CISA US
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · ENISA EU
v3.17.5highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:N/I:N/A:Hsecondary · productsecurity@jci.comAusnutzbarkeit 3.9 · Auswirkung 3.6
v3.18.3highCVSS:3.1/AV:N/AC:L/PR:N/UI:N/S:U/C:H/I:N/A:H/E:Usecondary · CVSS-BT (t0sche)
03

schwächen

Die CWE-Schwächeklassen, zu denen dies gehört.

CWE-611USprimärCWE-611US
04

betroffene Produkte (64)

Betroffene Produkte und Versionsbereiche.

20 von 64 angezeigt
05

Advisories (1)

Hersteller- und Ökosystem-Meldungen dazu.

  • ICSA-20-070-05Johnson Controls Metasys2020-03-10icsa · cisa_csaf_otUS

    Successful exploitation of this vulnerability can allow a denial-of-service attack or disclosure of sensitive data.

06

auch bekannt als (3)

Weitere Namen und Kennungen dieser Entität.

07

quellen

Welche Quellen diesen Datensatz belegen und wann.

cnnvdenisa_euvdcisa_csaf_otNVDCVE.orgMITRE
veröffentlicht 2020-03-10geändert 2026-06-17
09

Referenzen (8)

Externe Belege — Patches, Meldungen, Analysen.

scry

Angreifer nutzen Schwachstellen wie diese gegen im Internet exponierte Dienste aus. Sehen Sie mit einem kostenlosen Passiv-Scan, was exponiert ist.

Kostenloser Scan